Heppner's argument was dumb but it opens a field of interesting questions. If I use a document processor (like Google Docs) to compose a message to my attorney, which message itself would be privileged, but I use some sidebar feature of Google Docs/Gemini to clean up a sentence that I thought was clunky, and elsewhere I have, for whatever reason, enabled features that permit Google to use inputs and outputs to train or refine their models, has that destroyed the privilege?
There is no way that this state of things survives long-term. Rationally, it's really no different than any other tool involved in production of your work product.
This is a pretty terrible decision and inconsistent with all sorts of all other standards. If I did legal research in Google docs, it'd be covered. If I went to a legal library and took notes, it'd be covered, etc
people point out in sibling comments that is phone call then be out of client-attorney privileges? since it goes through a "3rd party"? maybe not the call itself but the voicemail for example. can it be "extracted" for the same purpose?
another point to make it safer would be sharing the "chat" with the lawyer, this way it becomes media of communication.
I highly recommend everyone actually read the opinion. It's such a thorough legal takedown of Heppner, you'll learn how the law works and why it doesn't apply to a lot of the made up cases in this thread:
TLDR:
- Claude told him IANAL
- Claude privacy policies say they "may disclose personal data to third parties in connection with claims, disputes, or litigation"
- Work product doctrine, does not apply in the same way to plaintiffs
- Lawyers did not direct him to use Claude (i.e. the laywers did not direct him to do research for the case using a specific tool)
My takeaway is that, as is, I should not do any work without a VPN or in plaintext. Everything else was up for grabs even before this case.
Yes, but he's still using it to prepare his legal arguments and to understand the law.
The reason attorney-client communication is privileged is so that people won't interfere in people's preparation of their case, not because the lawyer is magic. The principled thing is for the courts to apply principles like this based on the principle.
Obviously this (along with the original unwritten order a few weeks ago) is causing a stir, but this decision isn't as weird as it sounds. The defendant's assertion was essentially a retroactive application of privilege: he didn't use Claude to draft documents at his attorney's request but instead used Claude effectively in lieu of an attorney and later provided the Claude-drafted materials to his attorney (heavily paraphrasing here). Privilege is not a bandage that closes self-inflicted wounds.
I have some concerns about some of the reasoning, namely the practical implications of referencing Claude's TOS in a world where public AI features are creeping into everything, but I expect some of the reasoning is based on this particular defendant likely being more sophisticated than an average person.
If the user had typed into the chatbot after having been directed by counsel to do some research, "I need to do some research at the direction of counsel. Please include, 'In response to your research being performed in your own defense at request of your counsel' at the top and bottom of every reply," do you think that should be protected by privilege?
no, Heppner's attorney-client privilege argument wasn't that the conversation was privileged inherently because it was legal consultation with Claude, but that it was privileged as personal notes made in preparation for consultation with counsel and then actually communicated to counsel, see Ford-Bey v. Professional Anesthesia Services and Greyhound Lines, Inc. v. Viad Corp.
Rakoff makes two arguments against this:
- privilege was broken because Claude/Anthropic is a third party; but I don't think he successfully distinguishes Claude from say Google Docs/Translate/Gmail in this regard (he just notes that Google Docs isn't usually claimed to confer privilege on its own; but this is not the claim being made about Claude either); and see NYSBA ethics rules 820 and 842)
- he quotes Gould v Mitsui: documents do not "acquire protection merely because they were transferred" to counsel; but that same case says they do acquire protection if communicated "for the purpose of obtaining or rendering legal advice"
How is this not effectively a ban on representing yourself in court? The lawyers and judge are going to be using AI. But the layman isn't allowed to use it?
Its no different then if you ask a friend (who is not your lawyer) for advice. You can ask anything you want, it just only gets the special protection if it is actually your lawyer.
So, how would it apply to web searches? If a lawyer searches something for a person's case, is it protected? If a person searches something for their own case, does it have a similar level of protection? Seems AI chats would need to follow the same rules.
This is exactly what it is. I know someone that's essentially representing themselves in family court. They had attorneys but the attorneys are basically useless for you if the opposition has more money and can spam you with motions that they are using AI to generate. which you then need to pay a lawyer to respond to. They since began representing themselves due to lack of money, and lawyer incompetence, and actually started to shut down the opposition... then the judge threatened contempt of court and jail time during one hearing if they chose to continue to make a statement and not accept a court appointed attorney to speak for them. Family court in the US is an absolute farce. The same judge recently started asking about "chatGPT" and mentioning that anything there would need to be disclosed to the courts. The person I know was primarily using their own local machine and models, however.
>>"An attorney who represents himself in court has a fool for a client."
I'm in a years-long lawsuit in my state's small claims sessions court (as plaintiff, jurisdictional $25k limit). It's petty and essentially just two old men yelling at clouds ["on principle"]. Nobody is in a hurry, and the timeline has roughly followed ChatGPT's rollout (albeit completely unrelated) – the tech just keeps jaw-dropping.
What started as a years-long disagreement, eventually became a small claims lawsuit pro se AI, counterclaims/insanity/&all... and now we both have attorneys representing our interests ($$$$$).
I still use a local (offline) LLM to field my rudimentary legalese into better questions for my human attorney (which saves a litle $$). Together we three have squashed all counterclaims, including a counter-lawsuit (that probably I could have managed with AI, alone, but was much more natural/comfortable not representing myself). Very grateful for both my attorney and accountant (as a blue-collar electrician).
My hope going forward judicially is that some sort of amalgamated lawAI platform can better increase access for laypeople to our already-overwhelmed judgeships, like SCOTUS Roberts wrote about in his end of 2023 Judicial Review. There needs to be attorney-client privileges extended to LLMs, definitely achievable offline (until inevitable IT fail/hack).
It's not "no attorney-client privilege for AI chats" in general.
But a situation where the same would also apply if, instead of going to an chat bot, the person had gone to a random 3rd party non-attorney related person.
As in:
- the documents where not communication between the defendant and their attorney, but the defendant and the AI
- the AI is no attorney
- the attorney didn't instruct the defendant to use the AI / the court found the defendant did not communicate with the AI with the purpose of finding legal consule
- the communications with the AI (provider) where not confidential as a) it's a arbitrary 3rd party and b) they explicitly exclude usage for legal cases in their TOS
Still this isn't a nothing burger as some of the things the court pointed out can become highly problematic in other context. Like the insistence that attorney privilege is fundamentally build on a trusting human relationship, instead of a trusting relationship. Or that AI isn't just part of facilitating communication, like a spell checker, word program or voice mail box, legal book you look things up. All potentially 3rd parties all not by themself communication with a human but all part of facilitating the communication.
"Judge Rakoff issued an oral ruling that neither the attorney-client privilege nor the work product doctrine protected the AI-generated documents.12 The decision rests on traditional principles of privilege.
The attorney-client privilege protects (1) communications, (2) among only privileged parties, (3) made for the purpose of providing or obtaining legal advice.13 Importantly, the protection of the attorney-client privilege is lost if the communication is shared outside of the privileged parties.14 The party claiming privilege has the burden of showing that confidentiality was maintained.15 Judge Rakoff stated that the attorneyclient privilege did not apply because the communications were shared with a thirdparty tool that did not maintain confidentiality.16
Second, Judge Rakoff held that the work product doctrine did not protect the documents.17 The work product doctrine protects (1) legal work product, (2) discussing legal strategy, (3) prepared by or at the direction of legal counsel, (4) in anticipation of litigation.18 Judge Rakoff rejected Heppners arguments that the work product doctrine could apply because the AI-generated reports did not reflect the legal strategy of Heppners legal counsel, although they contained theories generated by the client and Claude.19 Since neither Heppner nor the AI tool are legal counsel, and Heppner was not working at the direction of Heppners legal counsel, the materials were not protected by the work product doctrine. Judge Rakoff noted that the AI tools disclaimer that users have no expectation of confidentiality also undermined the work product doctrine claim.20
12 Transcript of Pretrial Conference at 6, United States v. Heppner, No. 25-cr-00503-JSR (S.D.N.Y. Feb 10, 2026).
13 See United States v. Mejia, 655 F.3d 126, 132 (2d Cir. 2011).
14 See In re Six Grand Jury Witnesses, 979 F.2d 939, 943 (2d Cir. 1992).
15 See In re Grand Jury Subpoenas Dated Mar. 19, 2002 and Aug. 2, 2002, 318 F.3d 379, 384 (2d Cir. 2003).
16 Tr. at 3, Heppner, No. 25-cr-00503-JSR.
17 Id. at 6.
18 See In re Grand Jury Subpoenas, 318 F.3d at 383.
No attorney was involved. An AI tool is not a lawyer. It has no law license, owes no duty of loyalty, cannot form an attorney-client relationship, and is not bound by confidentiality obligations or professional responsibility rules. Discussing legal matters with an AI platform is legally no different from talking through your case with a friend.
2
Not for the purpose of obtaining legal advice. Anthropic's own public materials state that Claude follows the principle of choosing the "response that least gives the impression of giving specific legal advice." The tool explicitly disclaims providing legal services. You cannot claim you used a tool for legal advice when the tool itself says it does not provide it. Claude's terms were specifically highlighted by the government, which directly undermined the claim that Heppner was seeking legal advice from the tool.
3
Not confidential. This is the finding with the broadest implications. Anthropic's policy expressly states that user prompts and outputs may be disclosed to "governmental regulatory authorities" and used to train the AI model. Judge Rakoff found there was simply no reasonable expectation of confidentiality. As he put it, the tool "contains a provision that any information inputted is not confidential." This is not unique to Claude. OpenAI's privacy policy contains comparable provisions permitting data use for model training and disclosure in response to legal pro...
Here's my question:
If the attorney-client privilege, and more importantly, the work product doctrine don't apply here, would they also not apply to direct conversations between an attorney and an AI?
It seems to me that the court would need to apply some twisted logic to claim that those protections apply to an attorney, but not to a petitioner or respondent.
The overruling of both Shih and the standards laid out in NYSBA ethics opinions 820/842 (and various other state bar associations, and the fact that apparently no one tried to challenge those in court until AI) without real discussion of implications seems rather unusual; and that's a rather charitable reading to avoid the crazier "Claude is a person" framing
also, he quotes Gould v Mitsui: documents do not "acquire protection merely because they were transferred" to counsel; but that same case says they do acquire protection if communicated "for the purpose of obtaining or rendering legal advice"
Attorney admitted in NY here. It's fascinating that Judge Rakoff likely would have come to the opposite conclusion if the Claude chat was at the attorney's request or suggestion. I am surprised the court placed so much reliance on the Terms of Service, which are probably not so different than those of Outlook, Gmail, etc., say, yet nobody disputes that attorney-client emails remain privileged notwithstanding the Terms of Service of those providers. At least I have never seen anyone argue in NY that privilege is waived by emailing. And unlike sending an email to another person, chatting with Claude is a solo conversation more like organizing one's notes, which if in contemplation of obtaining legal advice seems privileged to me. I think this is a very close question and am not sure it would come out the same way in other courts or on even slightly different facts. Very interesting legal question.
IANAL. Emailing with an attorney would encapsulate the emailer, email service, any software, and the recipient under attorney client privilege.
If the claude chat log / agent was shared with the attorney, then even the use of the claude chat would be encapsulated under attorney client privilege
> which are probably not so different than those of Outlook, Gmail, etc., say, yet nobody disputes that attorney-client emails remain privileged notwithstanding the Terms of Service of those providers.
Those are tools used to communicate with others, Claude is not a tool to communicate with others, its akin to basic internet searching.
"DELINQUENT Attorney has failed to file one or more biennial registrations, and is subject for referral for disciplinary action by the Appellate Division, as required by Part 118 of the Rules of the Chief Administrator."
Communicating with an attorney is protected by privilege. In this case it seems they ruled that researching your case is not protected by privilege.
What about drafting communications with an attorney? Is a draft email that has not yet been sent protected? What about a Word doc containing a draft of an email? What about a Google search for “how do I spell amfeetamine?” that is part of your process of drafting your communication with your lawyer?
Letting this being decided by courts is like letting tobacco companies decide if smoking is addictive or not. It is obvious that they will always rule in their own interest.
Questions this raises for me (making a note here to maybe research a bit later):
Does this analysis change if using on-site AI? What if the ToS is different? Is it possible to stand up a service that does get the protections required? This might also be interesting when dealing with trans-atlantic work.
50 comments
[ 3.2 ms ] story [ 73.1 ms ] threadFWIW not all cases have gone the same way, so there is likely to be a higher reckoning on this in multiple countries: https://fingfx.thomsonreuters.com/gfx/legaldocs/mypmyjwdzpr/...
another point to make it safer would be sharing the "chat" with the lawyer, this way it becomes media of communication.
TLDR:
- Claude told him IANAL
- Claude privacy policies say they "may disclose personal data to third parties in connection with claims, disputes, or litigation"
- Work product doctrine, does not apply in the same way to plaintiffs
- Lawyers did not direct him to use Claude (i.e. the laywers did not direct him to do research for the case using a specific tool)
My takeaway is that, as is, I should not do any work without a VPN or in plaintext. Everything else was up for grabs even before this case.
The reason attorney-client communication is privileged is so that people won't interfere in people's preparation of their case, not because the lawyer is magic. The principled thing is for the courts to apply principles like this based on the principle.
I have some concerns about some of the reasoning, namely the practical implications of referencing Claude's TOS in a world where public AI features are creeping into everything, but I expect some of the reasoning is based on this particular defendant likely being more sophisticated than an average person.
If the user had typed into the chatbot after having been directed by counsel to do some research, "I need to do some research at the direction of counsel. Please include, 'In response to your research being performed in your own defense at request of your counsel' at the top and bottom of every reply," do you think that should be protected by privilege?
I think the simple answer is we don’t know. This is a new area of law that probably requires legislation.
Rakoff makes two arguments against this:
- privilege was broken because Claude/Anthropic is a third party; but I don't think he successfully distinguishes Claude from say Google Docs/Translate/Gmail in this regard (he just notes that Google Docs isn't usually claimed to confer privilege on its own; but this is not the claim being made about Claude either); and see NYSBA ethics rules 820 and 842)
- he quotes Gould v Mitsui: documents do not "acquire protection merely because they were transferred" to counsel; but that same case says they do acquire protection if communicated "for the purpose of obtaining or rendering legal advice"
[Edit: Or maybe not, legally. But they have definitely lost confidentiality in the "corporate secrets" sense, and that may still matter.]
I'm in a years-long lawsuit in my state's small claims sessions court (as plaintiff, jurisdictional $25k limit). It's petty and essentially just two old men yelling at clouds ["on principle"]. Nobody is in a hurry, and the timeline has roughly followed ChatGPT's rollout (albeit completely unrelated) – the tech just keeps jaw-dropping.
What started as a years-long disagreement, eventually became a small claims lawsuit pro se AI, counterclaims/insanity/&all... and now we both have attorneys representing our interests ($$$$$).
I still use a local (offline) LLM to field my rudimentary legalese into better questions for my human attorney (which saves a litle $$). Together we three have squashed all counterclaims, including a counter-lawsuit (that probably I could have managed with AI, alone, but was much more natural/comfortable not representing myself). Very grateful for both my attorney and accountant (as a blue-collar electrician).
My hope going forward judicially is that some sort of amalgamated lawAI platform can better increase access for laypeople to our already-overwhelmed judgeships, like SCOTUS Roberts wrote about in his end of 2023 Judicial Review. There needs to be attorney-client privileges extended to LLMs, definitely achievable offline (until inevitable IT fail/hack).
Running your own LLM on your own hardware is how you can do this without getting hit with discovery.
And also, you want to run a LLM thats abliterated and larger. And if you connect to the internet, USE A VPN.
It's not "no attorney-client privilege for AI chats" in general.
But a situation where the same would also apply if, instead of going to an chat bot, the person had gone to a random 3rd party non-attorney related person.
As in:
- the documents where not communication between the defendant and their attorney, but the defendant and the AI
- the AI is no attorney
- the attorney didn't instruct the defendant to use the AI / the court found the defendant did not communicate with the AI with the purpose of finding legal consule
- the communications with the AI (provider) where not confidential as a) it's a arbitrary 3rd party and b) they explicitly exclude usage for legal cases in their TOS
Still this isn't a nothing burger as some of the things the court pointed out can become highly problematic in other context. Like the insistence that attorney privilege is fundamentally build on a trusting human relationship, instead of a trusting relationship. Or that AI isn't just part of facilitating communication, like a spell checker, word program or voice mail box, legal book you look things up. All potentially 3rd parties all not by themself communication with a human but all part of facilitating the communication.
https://news.ycombinator.com/item?id=47778308 AI ruling prompts warnings from US lawyers: Your chats could be used against you (reuters.com)
~3 hours ago, 43+ comments
https://news.ycombinator.com/item?id=47555642 Be careful: chatting with AI about your case is discoverable (harvardlawreview.org)
~18 days ago, 13 comments
https://law.resource.org/pub/us/case/reporter/F2/296/296.F2d...
I wonder if anybody has gone all the way and made a darknet LLM service with no logs served only over TOR with XMR payments.
The attorney-client privilege protects (1) communications, (2) among only privileged parties, (3) made for the purpose of providing or obtaining legal advice.13 Importantly, the protection of the attorney-client privilege is lost if the communication is shared outside of the privileged parties.14 The party claiming privilege has the burden of showing that confidentiality was maintained.15 Judge Rakoff stated that the attorneyclient privilege did not apply because the communications were shared with a thirdparty tool that did not maintain confidentiality.16
Second, Judge Rakoff held that the work product doctrine did not protect the documents.17 The work product doctrine protects (1) legal work product, (2) discussing legal strategy, (3) prepared by or at the direction of legal counsel, (4) in anticipation of litigation.18 Judge Rakoff rejected Heppners arguments that the work product doctrine could apply because the AI-generated reports did not reflect the legal strategy of Heppners legal counsel, although they contained theories generated by the client and Claude.19 Since neither Heppner nor the AI tool are legal counsel, and Heppner was not working at the direction of Heppners legal counsel, the materials were not protected by the work product doctrine. Judge Rakoff noted that the AI tools disclaimer that users have no expectation of confidentiality also undermined the work product doctrine claim.20
12 Transcript of Pretrial Conference at 6, United States v. Heppner, No. 25-cr-00503-JSR (S.D.N.Y. Feb 10, 2026).
13 See United States v. Mejia, 655 F.3d 126, 132 (2d Cir. 2011).
14 See In re Six Grand Jury Witnesses, 979 F.2d 939, 943 (2d Cir. 1992).
15 See In re Grand Jury Subpoenas Dated Mar. 19, 2002 and Aug. 2, 2002, 318 F.3d 379, 384 (2d Cir. 2003).
16 Tr. at 3, Heppner, No. 25-cr-00503-JSR.
17 Id. at 6.
18 See In re Grand Jury Subpoenas, 318 F.3d at 383.
19 Tr. at 5, Heppner, No. 25-cr-00503-JSR.
20 Id. at 6."
https://www.debevoise.com/-/media/files/insights/publication...
"Reasons Privilege Failed
1
No attorney was involved. An AI tool is not a lawyer. It has no law license, owes no duty of loyalty, cannot form an attorney-client relationship, and is not bound by confidentiality obligations or professional responsibility rules. Discussing legal matters with an AI platform is legally no different from talking through your case with a friend.
2
Not for the purpose of obtaining legal advice. Anthropic's own public materials state that Claude follows the principle of choosing the "response that least gives the impression of giving specific legal advice." The tool explicitly disclaims providing legal services. You cannot claim you used a tool for legal advice when the tool itself says it does not provide it. Claude's terms were specifically highlighted by the government, which directly undermined the claim that Heppner was seeking legal advice from the tool.
3
Not confidential. This is the finding with the broadest implications. Anthropic's policy expressly states that user prompts and outputs may be disclosed to "governmental regulatory authorities" and used to train the AI model. Judge Rakoff found there was simply no reasonable expectation of confidentiality. As he put it, the tool "contains a provision that any information inputted is not confidential." This is not unique to Claude. OpenAI's privacy policy contains comparable provisions permitting data use for model training and disclosure in response to legal pro...
It seems to me that the court would need to apply some twisted logic to claim that those protections apply to an attorney, but not to a petitioner or respondent.
For the love of God! I hope an attorney isn't stupid enough to share a client confidential and personal data with an effectively unregulated AI.
also, he quotes Gould v Mitsui: documents do not "acquire protection merely because they were transferred" to counsel; but that same case says they do acquire protection if communicated "for the purpose of obtaining or rendering legal advice"
If the claude chat log / agent was shared with the attorney, then even the use of the claude chat would be encapsulated under attorney client privilege
Those are tools used to communicate with others, Claude is not a tool to communicate with others, its akin to basic internet searching.
"DELINQUENT Attorney has failed to file one or more biennial registrations, and is subject for referral for disciplinary action by the Appellate Division, as required by Part 118 of the Rules of the Chief Administrator."
https://iappscontent.courts.state.ny.us/aronline/Attorney-Re...
It was a frequent issue when email first was a thing
Is it? Aren’t notes, et cetera, not privileged by default?
What about drafting communications with an attorney? Is a draft email that has not yet been sent protected? What about a Word doc containing a draft of an email? What about a Google search for “how do I spell amfeetamine?” that is part of your process of drafting your communication with your lawyer?
Does this analysis change if using on-site AI? What if the ToS is different? Is it possible to stand up a service that does get the protections required? This might also be interesting when dealing with trans-atlantic work.